Azure / Azure/Azure-Functions

[UX] - UseManagedIdentityCreds in Azure Functions on Azure Container Apps

Open
#2,457 3 comments 0 reactions 1 assignee Assigned to @fabiocav View on GitHub
Dominant language
PowerShell
Stars
1.1k
Forks
215
Avg merge
4h 2m
Merged PRs (30d)
1

Description

# Issue Title

UseManagedIdentityCreds in Azure Functions on Azure Container Apps

## Description

Azure Functions on Azure Container Apps is currently in preview and I would like to begin rolling it out for my company. While doing so in the Azure Portal I am prompted to provide the registry to pull our Function Container Image from as well as credentials for accessing the registry.

Our governance policy is such that Azure Functions must have `AcrUseManagedIdentityCreds` set to `true`. This works for App Services and Function Apps that are directed at App Service plans rather than App Container Environments. But for Function apps directed at running on Azure Container Environments, when trying to deploy a custom ARM template through Terraform's `AzAPI` provider, I get this message

> `AcrUseManagedIdentityCreds is invalid. AcrUseManagedIdentityCreds is not supported for Azure Functions on Azure Container apps. Please retry the operation without AcrUseManagedIdentityCreds.`

![image](https://github.com/Azure/Azure-Functions/assets/16280023/cbb0e5d8-a052-4880-80a8-59b08ed23ff2)

AzAPI template

```
resource "azapi_resource" "function" {
type = "Microsoft.Web/sites@2022-09-01"
parent_id = "our resource group ID"
location = "our target location"
response_export_values = ["*"]

name = "a function name"

identity {
type = "UserAssigned"
identity_ids = ["an identity with pull access to our registry"]
}

body = jsonencode({
kind = "functionapp,linux,container,azurecontainerapps"
properties = {
managedEnvironmentId = "our container app environment ID"
virtualNetworkSubnetId = "our subnet id in the container app environment"

clientAffinityEnabled = false
httpsOnly = true

siteConfig = {
acrUseManagedIdentityCreds = true
acrUserManagedIdentityID = data.azurerm_user_assigned_identity.acr.id
linuxFxVersion = "DOCKER|our-docker-registry/our-docker-registry/our-function-name:the-function-tag"

appSettings = [
{
"name" : "FUNCTIONS_EXTENSION_VERSION",
"value" : "~4"
},
{
"name" : "WEBSITES_ENABLE_APP_SERVICE_STORAGE",
"value" : "false"
}
]
}
}
})
}

```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.